# Using multiple Discourse sites with a single SSO provider
**URL:** https://meta.discourse.org/t/using-multiple-discourse-sites-with-a-single-sso-provider/82311
**Category:** SSO
**Created:** [March 6, 2018, 2:23pm UTC](https://meta.discourse.org/t/using-multiple-discourse-sites-with-a-single-sso-provider/82311 "2018-03-06T14:23:13Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Philip\_Colmer](https://meta.discourse.org/u/Philip_Colmer)
#### Post date: [March 6, 2018, 2:23pm UTC](https://meta.discourse.org/t/using-multiple-discourse-sites-with-a-single-sso-provider/82311/1 "2018-03-06T14:23:13Z")
We’re using an in-house SSO provider which authenticates against LDAP. We’ve extended the core functionality so that, when the user authenticates, the provider retrieves a list of groups from Discourse and then populates the add\_groups and remove\_groups based on that list of groups combined with group membership in LDAP.
In order for that to work with multiple Discourse sites, the SSO provider needs to know the URL of the Discourse site that is requesting the authentication.
I did have this working by retrieving the HTTP\_REFERER value but the referer field is no longer being populated for some reason. As a result, I’m now have to run two SSO providers running identical code.
I don’t think that Discourse provides the site URL when calling the SSO provider, and I can’t think of another way for the SSO provider to get the site URL if referer isn’t being populated.
Would it be possible to extend the [Discourse SSO](https://meta.discourse.org/t/13045?silent=true) specification so that the site URL **is** provided to the SSO provider?
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [March 7, 2018, 3:48am UTC](https://meta.discourse.org/t/using-multiple-discourse-sites-with-a-single-sso-provider/82311/2 "2018-03-07T03:48:57Z")
Note that referer is dropped in many http to https cases and vice versa.
---
### Author:  [@mpalmer](https://meta.discourse.org/u/mpalmer)
#### Post date: [March 7, 2018, 4:08am UTC](https://meta.discourse.org/t/using-multiple-discourse-sites-with-a-single-sso-provider/82311/3 "2018-03-07T04:08:32Z")
Surely the more logical extension would be to allow an `exactly_these_groups` parameter, so you don’t have to fiddle around with `add_groups` and `remove_groups`?
---
### Author:  [@simon](https://meta.discourse.org/u/simon)
#### Post date: [March 7, 2018, 5:08am UTC](https://meta.discourse.org/t/using-multiple-discourse-sites-with-a-single-sso-provider/82311/4 "2018-03-07T05:08:32Z")
> [@Philip\_Colmer](#):
>
> In order for that to work with multiple Discourse sites, the SSO provider needs to know the URL of the Discourse site that is requesting the authentication.
I’ve run into similar issues with WordPress multisite and SSO. This isn’t implemented in the WordPress plugin, but you could try adding a query parameter to the sso\_url that you set on Discourse. It could be used to determine which forum the request has come from.
---
### Author:  [@Philip\_Colmer](https://meta.discourse.org/u/Philip_Colmer)
#### Post date: [March 7, 2018, 8:30am UTC](https://meta.discourse.org/t/using-multiple-discourse-sites-with-a-single-sso-provider/82311/5 "2018-03-07T08:30:12Z")
> [@codinghorror](#):
>
> Note that referer is dropped in many http to https cases and vice versa.
Yes, I did discover that in the research I did yesterday. We’re definitely sticking to HTTPS - HTTPS. I found a Mozilla blog article explaining why referer was a bad idea generally, which is partly what prompted me to ask for ideas about how to solve this without that dependency.
> [@mpalmer](#):
>
> Surely the more logical extension would be to allow an exactly\_these\_groups parameter, so you don’t have to fiddle around with add\_groups and remove\_groups?
The problem is that there isn’t a 1:1 match between Discourse groups and LDAP groups in our infrastructure. We only have a few Discourse groups and I didn’t want to hard-code those into the SSO provider - I wanted the SSO code to query Discourse to get the group names, hence the need for the Discourse URL.
> [@simon](#):
>
> I’ve run into similar issues with WordPress multisite and SSO. This isn’t implemented in the WordPress plugin, but you could try adding a query parameter to the sso\_url that you set on Discourse. It could be used to determine which forum the request has come from.
A brilliantly simple solution! Thank you.